1SYSLOG(2) Linux Programmer's Manual SYSLOG(2)
2
6 syslog, klogctl - read and/or clear kernel message ring buffer; set
7 console_loglevel
8
10 int syslog(int type, char *bufp, int len);
11 /* No wrapper provided in glibc */
12 /* The glibc interface */
14 #include <sys/klog.h>
15 int klogctl(int type, char *bufp, int len);
17
19 Note: Probably, you are looking for the C library function syslog(),
20 which talks to syslogd(8); see syslog(3) for details.
21 This page describes the kernel syslog() system call, which is used to
23 control the kernel printk() buffer; the glibc wrapper function for the
24 system call is called klogctl().
25 The kernel log buffer
27 The kernel has a cyclic buffer of length LOG_BUF_LEN in which messages
28 given as arguments to the kernel function printk() are stored (regard‐
29 less of their log level). In early kernels, LOG_BUF_LEN had the value
30 4096; from kernel 1.3.54, it was 8192; from kernel 2.1.113, it was
31 16384; since kernel 2.4.23/2.6, the value is a kernel configuration
32 option (CONFIG_LOG_BUF_SHIFT, default value dependent on the architec‐
33 ture). Since Linux 2.6.6, the size can be queried with command type 10
34 (see below).
35 Commands
37 The type argument determines the action taken by this function. The
38 list below specifies the values for type. The symbolic names are
39 defined in the kernel source, but are not exported to user space; you
40 will either need to use the numbers, or define the names yourself.
41 SYSLOG_ACTION_CLOSE (0)
43 Close the log. Currently a NOP.
44 SYSLOG_ACTION_OPEN (1)
46 Open the log. Currently a NOP.
47 SYSLOG_ACTION_READ (2)
49 Read from the log. The call waits until the kernel log buffer
50 is nonempty, and then reads at most len bytes into the buffer
51 pointed to by bufp. The call returns the number of bytes read.
52 Bytes read from the log disappear from the log buffer: the
53 information can be read only once. This is the function exe‐
54 cuted by the kernel when a user program reads /proc/kmsg.
55 SYSLOG_ACTION_READ_ALL (3)
57 Read all messages remaining in the ring buffer, placing them in
58 the buffer pointed to by bufp. The call reads the last len
59 bytes from the log buffer (nondestructively), but will not read
60 more than was written into the buffer since the last "clear ring
61 buffer" command (see command 5 below)). The call returns the
62 number of bytes read.
63 SYSLOG_ACTION_READ_CLEAR (4)
65 Read and clear all messages remaining in the ring buffer. The
66 call does precisely the same as for a type of 3, but also exe‐
67 cutes the "clear ring buffer" command.
68 SYSLOG_ACTION_CLEAR (5)
7